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Abstract 

A number of algorithms for computing the simulation preorder on Kripke structures are available. 
The simulation algorithm by Gentilini, Piazza and Policriti (GPP) — subsequently corrected by van 
Glabbeek and Ploeger — reaches the best space bound, while the simulation algorithm by Ranzato and 
Tapparo (RT) attains the best time bound. Let E denote the state space, -» the transition relation and 
Psim the partition of E induced by simulation equivalence. We present a novel space and time Efficient 
Simulation algorithm, called ESim, that runs in 0(\P sim \H log |E|) time and 0(|P sim | 2 log |P sim | + 
|E| log |E|) space. ESim reaches the best space bound of GPP and significantly improves the GPP time 
bound by replacing a multiplicative factor P s i m with log |E|. Moreover, ESim significantly improves 
the space bound of RT by replacing a multiplicative factor | E | log E with | P s i m | log | P s i m | while closely 
approaching the best time bound of RT. 

1 Introduction 

Simulation preorder is a fundamental behavioral relation widely used in process algebra for establishing 
system correctness and in model checking as a suitable abstraction for reducing state spaces ||2]|6]- The 
problem of efficiently computing the simulation preorder (and equivalence) on finite Kripke structures has 
been thoroughly investigated and yielded a number of simulation algorithms f3] |4] [5] El HH El El 
|2TJ[22]. Both time and space complexities play important roles in simulation algorithms, since in several 
applications, especially in model checking, memory requirements may become a serious bottleneck as the 
input transition system grows. 

State of the Art. The best simulation algorithms are those by Gentilini, Piazza and Policriti (GPP) ifTUl 
[TTI — subsequently corrected by van Glabbeek and Ploeger in [12] — and by Ranzato and Tapparo 
(RT) 11201 |2TI . Consider a finite Kripke structure where £ denotes the state space, -» the transition re- 
lation and P S j m the partition of £ induced by simulation equivalence. The algorithm GPP attains a space 
bound of O ( I P S i m 1 2 log | P S im | + £ | log | £ | ) while it runs in O ( | P S j m | 2 1 -> | ) time, where these are both bit 
complexities (i.e., the word size is a single bit). Let us remark that both lfTT|[T2ll state the bit space com- 
plexity of GPP is in 0(|P sim | 2 + |£| log |P S i m |). However, this is not correct. In fact, GPP flj] Section 4, 
p. 98] assumes that the states belonging to some block are stored as a doubly linked list in order to remove 
and add states in constant time. Hence, this requires that the pointers in these doubly linked lists are able 
to distinguish |£| states, so that its bit space complexity is in 0(|£| log |£|). Furthermore, GPP uses Hen- 
zinger, Henzinger and Kopke [15] algorithm (HKK), which is called on a Kripke structure where states 
are blocks of the current partition. Since the bit space complexity of HHK is in 0(|£| 2 log |£|), due to 
the sets of states Rem(s) which are stored as lists, this adds a factor 0(|P s i m | 2 log |P s im|) to the bit space 
complexity of GPP, which therefore results to be 0(|P s i m | 2 log |P s i m | + |£| log |£|). It is worth remarking 
that a space complexity in 0(|P S i m | 2 + |£| log |P S i m |) can be considered optimal for a simulation algo- 
rithm, since this is of the same order as the size of the output, which needs 0(|P s i m | 2 ) space for storing 
the simulation preorder as a partial order on simulation equivalence classes and 0(|£| log |P S im|) space 
for storing the simulation equivalence class for any state. Hence, the bit space complexity of GPP can be 
considered quasi-optimal. On the other hand, the algorithm RT features the best time bound 0( |P S i m 1 1 ~H ) 
while it takes O ( | P s ; m | £ log £ | ) space. Let us also mention the simulation algorithm by Crafa, Ranzato 
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Algorithm 


Space complexity 


Time complexity 


RT [21 1 
CRT g) 

GPPini 


0(|P sim ||E|log|E|) 
0((|P sp ||P sim | + |E|)log|P sp |) 
0(|P s i m | 2 log|P sim | + |E|log|E|) 


O(lPimlH) 

0(|P sim |h| + |P sim | 2 h Pa - p -|) 

0(|Psim| 2 h|) 


ESim (this paper) 


0(|P sim | 2 log|P sim | + |£|log|E|) 


0(|P sim |h|log|S|) 



Table 1: Space and time complexities of simulation algorithms. 



and Tapparo |9l (CRT) which is a kind of compromise between GPP and RT: on the one hand, CRT retains 
a space complexity comparable with that of GPP while improving its time complexity of GPP-GP; on the 
other hand, CRT improves the space complexity of RT while significantly worsening its time complexity. 
The situation for RT, CRT and GPP is summarized in Table 15. ll where for CRT we have that P sp is a state 
partition such that |P s ; m | < |P sp | < Bisimulation Equivalence! ( m pratice |P s j m | |P S p|, as shown in 
0) and ^p. p -» = {(B, C) \ B G P sp , C G P sim , B^C}, so that |^ p =p. p =-| < 

Contributions. We present here a novel space and time Efficient Simulation algorithm, called ESim, 
which features a time complexity in O ( | P S j m 1 1 -> | log | E | ) and bit space complexity in O ( | P s j m \ 2 log | P s ; m | + 
|E| log |E|). Thus, ESim reaches the best space bound of GPP and significantly improves the GPP time 
bound 0(|P S i m | 2 |^|) by replacing a multiplicative factor |P S i m | with log |E|. Furthermore, ESim signif- 
icantly improves the RT space bound 0(|P S i m ||E| log |E|) by replacing a multiplicative factor |E| log |E| 
with |P S i m | log |P S i m | and closely approaches the best time bound of RT. 

Analogously to GPP and RT, ESim is a partition refinement algorithm, meaning that it maintains and 
iteratively refines a so-called partition-relation pair (P, <), where P is a partition of the state space E that 
overapproximates the final simulation partition P S i m , while < is a binary relation over the partition P which 
overapproximates the final simulation preorder. ESim relies on the following three main points, which in 
particular allow to attain the above complexity bounds. 

(1) Two distinct notions of partition and relation stability for a partition-relation pair are introduced. 
Accordingly, at high-level, ESim is designed as a partition refinement algorithm which iteratively 
performs two clearly distinct refinement steps: the refinement of the current partition P which splits 
some blocks of P and the refinement of the relation < which removes some pairs of blocks from P. 

(2) ESim exploits an efficient characterization of partition refiners, i.e., blocks of P that allow to split 
the current partition P. 

(3) ESim only relies on data structures, like lists and matrices, that are indexed on and contain blocks of 
the current partition P. The hard task here is to devise efficient ways to update these partition-based 
data structures along the iterations of ESim. We show how this can be actually done, in particular 
by resorting to Hopcroft's "process the smaller half" principle [17] when updating a crucial data 
structure after a partition splitting. 

2 Background 

2.1 Notation 

If R C S x E is any relation and X C E then R(X) = {x 1 G E | 3x G X. (x,x') G R}. Recall that 
R is a preorder relation when it is reflexive and transitive. If / is a function defined on p(E) and x G E 
then we often write f(x) to mean f({x}). A partition P of a set E is a set of nonempty subsets of E, 
called blocks, that are pairwise disjoint and whose union gives E. Part(E) denotes the set of partitions 
of E. If P G Part(E), s G E and S C E then P(s) denotes the block of P that contains s while 
P(S) = U se sP(s). Part(E) is endowed with the standard partial order Pi ^ P2, i.e. P2 is coarser 
than Pi, iff for any s G E, Pi(s) C P 2 (s). If Pi ^ P 2 and B G Pi then P 2 (P) is a block of P 2 which 
is also denoted by parent p 2 (B) (when clear from the context the subscript P 2 may be omitted). For a 



2 



given nonempty subset S C E called splitter, we denote by Split (P, S) the partition obtained from P by 
replacing each block B E P with BC\S and B \ S when these sets are nonempty, where we also allow no 
splitting, namely Split(P, S) = P (this happens exactly when P(S) — S). 

A transition system (E, ->) consists of a set E of states and of a transition relation -> C E x E. The 
predecessor/successor transformers pre, post : p(E) — > p(E) are defined as usual: prc(F) = {s e 
£ | 3i 6 y. s^t} and post(X) = {t G E | 3s G X s^t}. If Si, S 2 C E then Si-> 3 S 2 iff there exist si G 
Si and s 2 G S 2 such that si->s 2 . If P e Part(E) and CeP then pre 3 (C) = {P. G P | P^ 3 C}. Given 
a set ,4P of atomic propositions (of some specification language), a Kripke structure (KS) X = (E, 
over AP consists of a transition system (E, ->) together with a state labeling function £ : E -» p(j4P). 
Pf G Part(E) denotes the state partition induced by £, namely, P; = {{s' e E | £(s) = £(s')}} se j:. 

2.2 Simulation Preorder and Equivalence 

Let X = (E, be a KS. Recall that a relation R C E x E is a simulation on X if for any s, s' G E, if 
s' G P(s) then: (a) £(s) = £(s'); (b) For any t G E such that s->i, there exists t' G E such that s'^t' and 
t' e R(t). 

Given s,t G E, t simulates s, denoted by s < t, if there exists a simulation relation P such that 
t G P(s). The empty relation is a simulation and simulation relations are closed under arbitrary unions 
so that the largest simulation relation exists. It turns out that the largest simulation on X is a preorder 
relation called simulation preorder and denoted by P s i m . Thus, for any s, t G E, s < t iff (s, t) G P s im- 
Simulation equivalence P s i m0 q is the symmetric reduction of P s i m , namely P s i moq = P s ; m fl R~ im , so that 
(s, t) G Psimoq iff s < t and i < s. P s - lm G Part(E) denotes the partition corresponding to the equivalence 
Psimeq and is called the simulation partition. 

3 Basic Simulation Algorithm 
3.1 Partition-Relation Pairs 

A partition-relation pair CP = (P, <}, PR for short, is a state partition P G Part(E) together with a 
binary relation < C P x P between blocks of P. We write P < C when P < C and B ^ C and 
(P', C") < (P, C) when P' < P and C" < C. When < is a preorder/partial order relation then T is 
called, respectively, a preorder/partial order PR. 

PRs allow to represent symbolically, i.e. through state partitions, a relation between states. A relation 
P C E x E induces a PR PR(P) = (P, <> defined as follows: 

• for any s, P(s) = {t £ E | R(s) = R(t)}; 

• for any s,t G E, P(s) < P(i) iff £ G P(s). 

It is easy to note that if P is a preorder then PR(P) is a partial order PR. On the other hand, a given PR 
= (P <0 induces the following relation Rel(y): 

(s,t) e Rcl(y) <=> P(s) < P(i). 

Here, if T is a preorder PR then Rcl( J 5 ) is clearly a preorder. 

3 = (P, <J) is defined to be a simulation PR on a KS X when Rcl(J') is a simulation on X, namely 
when 7 represents a simulation relation between states. Hence, if J" is a simulation PR and P(s) = P(t) 
then s and t are simulation equivalent, while if P(s) < P(t) then t simulates s. 

Given a PR ? = (P, <), let us define a map /xy : p(E) — > p(E) as follows: for any X G p(E), 

^t(X) ^ Rel(T)(X) = U{C £ P I 3s G X. P(s) < C}. 

Note that, for any s e E, Aty(s) = Myl-PC 5 )) = U{C G P | P(s) < C}. This map allows us to 
characterize for preorder PRs the property of being a simulation as follows. 

Theorem 3.1. Let T = (P, <J) be a preorder PR. Then, T is a simulation iff 
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(i) ifB <C,beB and ceC then t(b) = 1(c); 

(ii) ifB^C andB < P then D^pLy(C); 

(iii) for any C e P, P = Spttt(P,pTe((j,y(C))). 

Proof. (=>) Condition (i) clearly holds. Assume that P-> 3 C and B < D. Hence, there exist b G B and 
c G C such that &^c. Consider any state d E D. Since CP is a simulation and P(b) < P(d), there exist some 
state e such that d^e and C = P(c) < P(e). Hence, D^fiy(C). Finally, if C G P and x G pre(jUy(C)) 
then there exists some block D > C and state d £ D such that x-xi. If y S P(a:) then since P(x) = P(y), 
by reflexivity of <j, we have that P(x) < P(y), so that, since CP is a simulation, there exists some state e 
such that y^e and P(cf) < P(e). Since < is transitive, we have that C < P(e). Hence, y G pre(/xy(C)). 
We have thus shown that P(x) C pre(/xy(C)), so that P = Split (P, pre(/iy(C))). 

(•£=) Let us show that Rel(CP) is a simulation, i.e., if P(s) < P(s') then: (a) i(s) = t(s'); (b) if s^i 
then there exists t' such that s'->t' and P(f) < P(t'). Condition (a) holds by hypothesis (i). If s->t then 
P(s)-> 3 P(t) so that, by condition (ii), we have that P(s')^ 3 fj,?(P(t)), namely there exists s" £ P(s') 
such that s" € pre(//y(P(t))). By condition (iii), P(s") C pre(^y(P(t))), i.e., s' G pre(/xy(P(t))). 
Hence, there exists t' such that s'->i' and P(t) < P(t')- □ 

3.2 Partition and Relation Refiners 

By Theorem l3.ll assuming that condition (i) holds, there are two possible reasons for a PR T = (P, <) for 
not being a simulation: 

1. There exist B,C,D G P such that P-> 3 C, B < D, but Z? 7 4 3 J u g) (C); in this case we say that the 
block C is a relation refiner for T. 

2. There exist P, C G P such that B n pre (/iy(C)) ^ 0butP ^ pre(/iy(C)); in this case we say that 
the block C is a partition refiner for 5\ 

We therefore define 

RRefmer(T) = {C G P | C is a relation refiner for CP} 

PRefmer(IP) = {C G P | C is a partition refiner for IP} 

and we say that CP is relation or partition stable when, respectively, RRefiner(J') = or PRefiner(CP) = 0. 
Then, Theorem 13 . 1 1 reads as follows: CP is a simulation iff CP satisfies condition (i) and is both relation and 
partition stable. 

If C G PRefiner(CP) then P is first refined to P' = Split (P, pre(/xy(C))), i.e. P is split w.r.t. the 
splitter S = pre(/iy(C)). Accordingly, the relation < can be transformed into the following relation <' 
defined on P'\ 

<' = {(D, E) eP' XP' | parentp(P) < parent P (P)} (1) 

Two blocks D and E of the refined partition P' are related by <' if their parent blocks parent P (P) 
and parentp(P) in P were related by <. Hence, if CP' = (P, <') then for all D G P', we have that 
Hyi (D) = /iy(parent P (P)). We will show that this refinement of (P, <) is correct because if B G P is 
split into B\S and BnS then all the states in B \ S 1 are not simulation equivalent to all the states in B n 5 1 . 
Note that if P G P has been split into P n S and P \ 5 then both PnS'<'P\5andP\5<'PnS' 
hold, and consequently CP' becomes relation unstable. 

On the other hand, if CP is partition stable and C G RRcfmcr(CP) then we will show that < can be safely 
refined to the following relation <': 

<' = < \{(P, D) G P x P P^ 3 C, P <D, D -^n 7 (C)} 

= {(B,D)ePxP\B<D, (B^C D^fi 7 (C))} (2) 

because if (P, D) G < n <' then all the states in P cannot simulate all the states in P. 

The above ideas lead us to design a basic simulation algorithm ESim described in Figure Q] ESim 
maintains a PR CP = (P, <) which is initialized as (Pg, id) and then iteratively refined as follows: 
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1 ESim(PR (P, <}) { 

2 Initialized); P Stabilized); boolPStable := RStabilizeQ; boolRStable := tt; 

3 while ^(PStable & RStable) do 

4 if -. PStable then {RStable := PStabilize{); PStable := tt} 
s if -i RStable then {PStable := RStabilizeQ; RStable := tt} 

« } 

7 bool PStabilizeQ { 

8 P old := P; 

9 while 3C € PRefiner(lP) do 

10 S := pre(p v (C)); P := Split(S); 

n _ forall (D, E) G P x P do D < E := parent(D) < parent(£); 

12 return (P = P id); 

13 } 

14 bool RStabilizeQ { 

15 / / Precondition: PStable is tt 

16 <oid := <; Delete := 0; 

n while 3C G RRenner(CP) do 

is |_ Delete := Delete U {(B, D) € P x P \ B < D, B^ 3 C, D /j, v (G)}; 

19 < := < n Delete; 

20 return (< = < id); 

21 } 



Figure 1: Basic Simulation Algorithm. 



(A) If (P, <) is not partition stable then the partition P is split for pre(/iy(C)) as long as a partition 
refiner C for CP exists, and when this happens the relation < is transformed to <' as defined by ([T]); 
at the end of this process, we have a PR CP' = (P', <') which is partition stable and if P has been 
actually refined, i.e. P 1 ~< P then the current PR CP' becomes relation unstable. 

(B) If (P, <) is not relation stable then the relation < is refined to <' as described by (f2]i as long as a 
relation refiner for CP exists; hence, at the end of this refinement process (P, <') becomes relation 
stable but possibly partition unstable. 

Moreover, the following properties of the current PR of ESim hold. 

Lemma 3.2. In any run o/ESim, the following two conditions hold: 

(i) If P Stabilize is called on a partial order PR (P, <) then at the exit we obtain a PR (P', <') which 
is a preorder. 

(ii) If RStabilize is called on a preorder PR (P, <} then at the exit we obtain a PR (P, <') which is a 
partial order. 

Proof. Let us first consider PStabilize. Consider an input partial order PR CP = (P, <}, a splitter S such 
that P' = Split (P, S) and let <' be defined as in equation Let us show that (P' ; <') is a preorder PR. 

(Reflexivity): If B e P' then, as < is reflexive, P(B) < P(P) and thus B <' B. 

(Transitivity): Assume that B,C,D G P' and P <' C and C <' P. Then, P(P) < P(C) and P(C*) < 
P(D), so that by transitivity of <, P(B) < P(D). Hence, B <' D. 

Let us then take into account RStabilize, consider an input preorder PR CP = (P, <) and let (P, <') be the 
output PR of RStabilize. 

(Reflexivity): If B G P then, by reflexivity of <, B < B. If P^ 3 C, for some C G P, then since C < C 
by reflexivity of <, we have that B~^ [iy(C\ Hence, B <' P. 
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(Transitivity): Assume that B <' C and C <' D. Then, B < C and C < D, so that by transitivity 
of <, P < D. If B^E then, since B <' C, C^ 3 (x?(E). Hence, there exists F e P such that 
E < F and C-> a P. Since C <' B, we have that D-^p, v (F). Since < is transitive and E < F, 
l^v(P) C fiy(E). Thus, we have shown that B-> a B implies D^py(E), namely B <' P. 

(Antisymmetry): We observe that after calling PStabilize on a partial order PR, antisymmetry can be lost 
because for any block B which is split into B\ = B n S and B2 = B % 5, where 5 = pre(/xy(C)), 
we have that B\ < B2 and B2 <! Pi- In this case, RStabilize removes the pair (B P\ S,B \ S) 
from the relation <: in fact, while B n 5 C pre(/iy(C)) and therefore B n S-> E, for some 
block J5 C no>(C), we have that (B \ S) n pre(//y(C)) = 0, so that, since /Ja>(J5) C fiy(C), 
(B \ 5) n pre(^ip(£)) = 0, i.e., B \ 5 ^fi T {E), and therefore B n S B \ 5. Hence, 
RStabilize outputs a relation <' which is antisymmetric. 

□ 

The main loop of ESim terminates when the current PR (P, <} becomes both partition and relation 
stable. By the above Lemma [3721 the output PR CP of ESim is a partial order, and hence a preorder, so that 
Theorem B.ll can be applied to CP which is then a simulation PR. It turns out that this algorithm is correct, 
meaning that the output PR CP represents the simulation preorder. 

Theorem 3.3 (Correctness). Let £ be finite. ESim is correct, i.e., if (P, <j) is the output PR q/ESim on 
input (Pi, id) then for any s,t G S, s < t <^> P(s) < P(t). 

Proof. Let us first note that ESim always terminates. In fact, if (P, <) is the current PR at the beginning 
of some iteration of the while-loop of ESim and (P' , <') is the current PR at the beginning of the next 
iteration then, since (P', <') is either partition or relation unstable, we have that either P' < P or P' = P 
and <' C <. Since the state space S is finite, at some iteration it must happen that P' = P and <' = < so 
that PStable & RStable = tt. 

When ESim terminates, we have that RRefiner((P, <)) = = PRefmer((P, <)). Also, let us 
observe that condition (i) of Theorem 13. II always holds for the current PR (P, <j) because the input PR 
(Pi, id) initially satisfies condition (i) and this condition is clearly preserved at any iteration of ESim. 
Furthermore, at the beginning, we have that (P, <) = (Pi, id) and this is trivially a partial order. Thus, 
we can apply Lemma [3~2l for any call to PStabilize and RStabilize, so that we obtain that the output PR 
(P, ^) is a preorder. Hence, Theorem B.ll can be applied to the output preorder PR (P, <), which is then a 
simulation. Thus, Rel((P, <)) C P s ; m . 

Conversely, let us show that if CP is the output PR of ESim then P s i m C Rel(CP). This is shown as 
follows: if CP is a preorder PR such that P S i m C Rel(CP) and RStabilize or PStabilize are called on CP then 
at the exit we obtain a PR CP' such that P sim C Rel(CP'). 

Let us first take into account RStabilize, consider an input preorder PR CP = (P, <} such that P s ; m C 
Rel(CP), and let CP' = (P, <') be the output PR of RStabilize. We show that P sim C Rel(CP'), that is, for 
any s, t 6 S, if s < t then P(s) <j' P(t). By hypothesis, from s < t we obtain P(s) < Pit). Assume 
that P(s)^ 3 C, for some C G P. Hence, P(s)->- p,y(C). Since the PR CP is partition stable, we have that 
P(s) Q P re (A*3 3 (C))- Thus, there exists some D G P and d G D such that C < D and s-^d. Therefore, 
since t simulates s, there exists some state e such that t^e and d < e. By hypothesis, from d < e we obtain 
D = P(d) < P(e). Hence, from C < D and D < P(e), since < is transitive, we obtain C < P(e). Thus, 
<^ 3 /iy(C) and in turn P(i)^ 3 /iy (C). We can thus conclude that P(s) <' P(t). 

Let us now consider PStabilize. Consider an input preorder PR CP = (P, <} (which, by Lemma [3~2l 
actually is a partial order PR) such that P S i m C Rel(CP). Consider a splitter S such that P' = Split (P, S) 
and let <' be defined as in equation (\}. Let CP' = (P', <') and let us check that P sim C Rel(CP'), i.e., if 
s < t then P'(s) <' P'(t). By hypothesis, if s < t then P(s) < P(t). Moreover, by definition of <' and 
since P' ■< P, P(s) < P(t) iff P'(s) <' P'(t). 

To sum up, we have shown that for the output PR (P, <), P S j m = Rcl((P, <)), so that s < t iff 
P(s) < P(t). 

□ 
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1 Initialize () { 

2 / / Initialize BCount 

3 forall B g P do 

4 |_ forall C g P do BCount(P, C) := 0; 

5 forall B g P do 

6 forall igBdo 

7 forall y g post(a') do 
|_ if (BCount(B, j/.block) = 0) then BCount(B, y.block) 

9 / / Initialize preE 
to updatePreEQ; I / In FigurefS] 

11 / / Initialize Count 

12 forall B e Pdo 

13 |_ forall C g P do Count(B, C) := 0; 

14 forall D g P do 
is forall P g P/.preE do 

|_ forall C g P such that C < D do Count(P, C)++; 

17 // Initialize Pem 
is forall C g P do 

forall P g P do 

forall D g P.preE do 
|_ if (Count(D, C) = 0) then Rem{C). append(P); 



22 } 



Figure 2: Initialization of data structures. 



4 Efficient Implementation 

4.1 Data Structures 

ESim is implemented by using the following data structures. 

States: A state s is represented by a record that contains the list post(s) of its successors, a pointer s.block 
to the block P(s) that contains s and a boolean flag used for marking. The state space E is repre- 
sented as a doubly linked list of states. {post(s)} se s therefore represents the input transition system. 

Partition: The states of any block B of the current partition P are consecutive in the list E, so that B 
is represented by two pointers begin and end: B .begin is the first state of B in E and B.end is the 
successor of the last state of B in E, i.e., B = [B .begin, _B.end[. Moreover, B stores a boolean 
flag B. intersection and a block pointer B. brother whose meanings are as follows: after a call to 
Split (P, S) for splitting P w.r.t. a set of states S, if Si = B n S and B 2 = B \ S, for some B e P 
that has been split by S then B\. intersection = tt and i?2 -intersection = ff, while B\ .brother points 
to B2 and ^-brother points to B\. If instead B has not been split by S then B. intersection = null 
and B. brother = null. Also, any block B stores in Rem(B) a list of blocks of P, which is used by 
RStabilize, and in S.preE the list of blocks C G P such that C-> 3 J5. Finally, any block B stores in 
S.size the size of B, in B. count an integer counter bounded by \P\ which is used by PStabilize and 
a pair of boolean flags used for marking. The current partition P is stored as a doubly linked list of 
blocks. 

Relation: The current relation < on P is stored as a resizable \P\ x \P\ boolean matrix. Recall [8 
Section 17.4] that insert operations in a resizable array (whose capacity is doubled as needed) take 
amortized constant time, and that a resizable matrix (or table) can be implemented as a resizable 
array of resizable arrays. The boolean matrix < is resized by adding a new entry to <, namely a new 
row and a new column, for any block B that is split into two new blocks B \ S and B n S. The old 
entry B becomes the entry for the new block B \ S while the new entries represent the new block 

Bns. 
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1 bool PStabilizeQ { 

2 list (Block) split := 0; 

3 while (C := FindPRefinerQ) ^ null) do 

4 list(State) 5 := pre^(C); .vpfo := SpIit(S); 

5 updateRel(split); updateBCount(split); updatePreEQ; 

6 updateCount(split); updateRem(split); 

i return (split = 0); 
* } 

9 Block FindPRefinerQ { 
10 forall BePdo 

list(Block) p := Post(B); 
forall C £ p do 
|_ if (Count(B, C) = 1) then return C; 



14 return null; 

15 } 

16 list (Block) Post (BlockB) { 

17 list (Block) p := 0; 
is forall b £ B do 

19 forall c £ post(fe) do 

20 Block C := c. block; 

21 if unmarkedl (C) then {markl(C); C. count = 0; p.append(C); } 

22 if unmarked2(C) then {mark2(C); C.count++;} 

forall C £ p do unmark2(C); 

24 forall C £ p do 

25 unmarkl(C); 

26 if (C.count = B.size) then p.remove(C); 

27 return p; 

28 } 

Figure 3: PStabilize Algorithm. 



Auxiliary Data Structures: We store and maintain a resizable boolean matrix BCount and a resizable 
integer matrix Count, both indexed over P and having the following meanings: 



BCount^, C) 



1 if B^C 
xfB^C 

Count(B, C) = E B>c BCount( J B, E). 



Hence, Count(£?, C) stores the number of blocks E such that C < E and B^E. The table Count 
allows to implement the test B -/^ pre(/iy(C)) in constant time as Count(£?, C) = 0. 

The data structures BCount, preE, Count and Rem are initialized by the function Initialize at line 2 of 
ESim, which is described in Figure [2] 

4.2 Partition Stability 

Our efficient implementation of ESim will rely on the following characterization of partition refiners. 

Theorem 4.1. Let (P, <} be a partial order PR. Then, PRefiner((P, <)) ^ iff there exists B,C e P 
such that the following three conditions hold: 

(i) B^C; 

(ii) for any C £ P, if C < C then B ^C; 

(iii) B % pre(C). 
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1 list(State) pre^(Block C) { 

2 list(State) S := 0; 

3 forall ieSdo 
forall y 6 post(a') do 

|_ if (C* ^ block & unmarked(rc)) then {S.append(:r); mark(x);} 

6 forall igSdo unmark(ic); 

7 return 5; 

s } 

9 list (Block) Spirt (list(State) S) { 

10 list(Block) split; forall B £ P do B.intersection := null; 

n forall ie S 5 do 

12 if (x. block. intersection = null) then 

13 x. block. intersection := ff; 

14 Block B := new Block; x.block.brother := B; 

15 B. brother := x. block; B. intersection := tt; 

16 split. append(a;. block); 

17 move x in the list S from x. block at the end of B; 
is if (x. block = 0) then // x.block C S 

19 rr.block.begin := B. begin; rr.block.end := B.end; 

20 n. block. brother := null; x. block. intersection := null; 

21 split.remove(:r. block); delete B; 

22 return split; 

23 } 



Figure 4: Split Algorithm. 



Proof. Let T = (P,<). 

(-^=) From condition (i) we have that Bnpre(/xy(C)) 0. From conditions (ii) and (iii), B $Z pre(/zj>(C)). 
Thus, C G PRefiner(T). 

(=>) Assume that PRefiner(!P) ^ 0. Since (P, <) is a partial order, we consider a partition refiner C G 
max(PRefiner(CP)) which is maximal w.r.t. the partial order <• Since C is a partition refiner, there exists 
some B e P such that B n pre(^y(C)) ^ and B g pre(^g>(C)). If C G P is such that C <J C" 
then C" cannot be a partition refiner because C is a maximal partition refiner. Hence, if C" then 
S C pre(/iy (C)), because C" is not a partition refiner, so that, since pre(/x;p(C')) C pre(/i3>(C)), 
S C pre(/iy(C)), which is a contradiction. Hence, for any C € P if C <3 C" then i? -fi C. Therefore, 
from n pre(/xj)(C)) / 0we obtain that B^C. Moreover, from £? ^ P re (/ x 5 J (C)) we obtain that 
B £ pre(C). □ 

Notice that this characterization of partition refiners requires that the current PR is a partial order 
relation and, by Lemma [3~2l for any call to PStabilize, this is actually guaranteed by the ESim algorithm . 

The algorithm in Figure [3] is an implementation of the basic algorithm PStabilize that relies on The- 
orem 14.11 and on the above data structures. The function FindPRefiner implements the conditions of 
Theorem l4.ll it returns a partition refiner for the current PR T = (P,<) when this exists otherwise returns 
a null pointer. Given a block B G P, the function call Post(B) returns a list of blocks C £ P that satisfy 
conditions (i) and (iii) of Theorem 14.11 i.e., those blocks C such that S-> 3 C and B <2 pre(C). This is 
accomplished through the counter C.count that at the exit of the for-loop at lines 18-23 stores the number 
of states in B having (at least) an outgoing transitions to C, i.e., C.count = \B n pre(C)|. Hence, we have 
that: 

B^C and B % pre(C) 1 < C.count < B.size. 

Then, for any candidate partition refiner C G Post(B), it remains to check condition (ii) of Theorem l4.ll 
This condition is checked in FindPRefiner by testing whether Count(£>, C) = 1: this is correct because 
Count(_B, C) > 1 holds since C G Post(B) and therefore B^C, so that 

County, C) = 1 iff VC' G P.C < C => B -f>C . 
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i updateRel (list (Block) split) { 


2 forall B 6 split do addNewEntry(_B) in matrix <; 


i forall BePdo 


4 


forall C G split do 


5 




if (B. intersection = tt) then B < C := B. brother < Cbrother; 


6 




else B^C:=B< Cbrother; 


7 forall C G P do 


8 


forall _B G split do 


9 


|_ if (C.intersection = ff) then B < C := B. brother < C; 


10 } 






li updateBCoimt(]ist{B\ock) split) { 


12 forall B G *pZft do addNewEntry(_B) in matrix Count; 


13 forall BgPdo 


14 


forall igBdo 


15 


|_ forall y G post (a:) do BCount(_B, y. block) := 0; 


16 forall BePdo 


17 


forall i£Pdo 


18 




forall y G post(a') do 


19 




|_ if (BCount(B, i/.block) = 0) then BCount(,B, y.block) := 1; 


20 } 






21 updatePreEQ { 


22 forall £ G P do B.preE := 0; 


23 forall PgPdo 


24 


forall xgBdo 


25 


|^ forall y G post(x) do {unmark(_B); y. block. preE.append(iJ);} 


26 forall C G P do 


27 


forall S G C.preE do 


28 




if unmarked (B) then mark(B); 


29 




else C.preE.remove(B); 


30 


forall B G C.preE do unmark(B); 


31 } 






32 updateRem (list (Block) split) { 


33 forall B G split do Rem(B) := Rem(B. brother); 


34 } 










Figure 5: update functions. 



Hence, if Count(_B, C) = 1 holds at line 13 of FindF 'Refiner, by Theorem 14.11 C is a partition refiner. 
Once a partition refiner C has been returned by Post (B), P Stabilize splits the current partition P w.r.t. the 
splitter S = pre(^y(C)) by calling the function Split(S), updates the relation < as defined by equationQ] 
in Section l3~2l bv calling updateRel, updates the data structures BCount, preE, Count and Rem, and then 
check again whether a partition refiner exists. At the exit of the main while-loop of PStabilize, the current 
PR (P, <) is partition stable. 

PStabilize calls the functions pre/i and Split that are described in Figure [4] Recall that the states of a 
block B of P are consecutive in the list of states E, so that B is represented as B — [B. begin, _B.end[. The 
implementation of Split(S) is quite standard (see e.g. lfT3ll2TI ) and only scans the states in S, i.e. Split(S) 
takes 0(| S\) time. This operation affects the ordering of the states in the list E because states are moved 
from old blocks to newly generated blocks. 

We will show that the overall time complexity of PStabilize along a run of ESim is in 0(|P S im| HI)- 
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4.3 Updating Data Structures 

In the function RStabilize, after calling Split(S), firstly we need to update the boolean matrix that stores 
the relation < in accordance with definition {!]) in Section USl After that, since both P and < are changed 
we need to update the data structures BCount, preE, Count and Rem. In Figure [5] we describe the imple- 
mentations of the functions updateRel, updateBCount, updatePreE and updateRem, which are quite simple 
and easy to understand. 

The function updateCount is in Figure [6] and deserves special care in order to design a time efficient 
implementation. The core part of the updateCount algorithm follows Hopcroft's "process the smaller 
half" principle [17| for updating the integer matrix Count. Let P' be the partition which is obtained by 
splitting the partition P w.r.t. the splitter S. Let B be a block of P that has been split into B n S and 
B \ S. Thus, we need to update Count(i3 n S, C) and Count(_B \ S, C) for any C G P 1 by knowing 
Count(£>, parentp(C)). Let us first observe that after lines 3-10 of updateCount, we have that for any 
B,C e P', Count(B, C) = Count(parentp(B),parent P (C)). Let X be the block in {Bn S, B\ S} with 
the smaller size, and let Z be the other block, so that | X \ < \Z\ and |X| + |Z| = | B | . LetCbe any block in 
P'. We set Count(X, C) to 0, while Count(Z. C) is left unchanged, namely Count(Z. C) = Count(B, C). 
We can correctly update both Count(Z, C) and Count(X, C) by just scanning all the outgoing transitions 
from X. In fact, if x G X, x^y and the block P(y) is scanned for the first time then for all C < P(y), 
Count(X, C) is incremented by 1 while if Z fi 3 P(y), i.e. BCount(Z, P{y)) = 0, then Count(Z, C) is 
decremented by 1, The correctness of this procedure goes as follows: 

(1) At the end, Count(X, C) is clearly correct because its value has been re-computed from scratch; 

(2) At the end, Count(Z, C) is correct because Count(Z, C) initially stores the value Count(B, C), 
and if there exists some block D such that C < D, B->^D whereas Z -/^D — this is correctly 
implemented at line 26 as BCount(Z, D) = 0, since the date structure BCount is up to date — 
then necessarily X^D, because B has been split into X and Z, so that D = P(y) for some 
y G post(X), namely D has been taken into account by some increment Count(X, C)++ at line 25 
and consequently Count(Z, C) is decremented by 1 at line 26. 

Moreover, if some block D G P 1 \ {B n S, B \ S} is such that both D^X and D^Z hold then for all 
the blocks C G P such that C < X (or, equivalently, C < Z), we need to increment Count(Z), C) by 1. 
This is done at lines 28-30 by relying on the updated date structures preE and BCount. 
Let us observe that the time complexity of a single call of updateCount(split) is 

\P\(\spUt\+ {\{(x,y)\xeX, y e^x^y}\ + \{(X,D)\DeP,X^D}\)y 
xespiit 

Hence, let us calculate the overall time complexity of updateCount. If X and X 1 are two blocks that 
are scanned in two different calls of updateCount and X' C X then \X'\ < \X\/2. Consequently, any 
transition x^y at line 21 and D^X at line 28 can be scanned in some call of updateCount at most log 2 |S| 
times. Thus, the overall time complexity of updateCount is in 0(|P S im|| _ * , | log |S|). 

4.4 Relation Stability 

The basic procedure RStabilize in FigureQ]is implemented by the algorithm in Figure|7] Let CP m = (P, < ln ) 
be the current PR when calling RStabilize. For each relation refiner C G P, RStabilize must iteratively 
refine the initial relation < m in accordance with equation (0 in Section [3~2l Hence, if B-^C, B < D and 
D-fi^fiyin (C), the entry B < D of the boolean matrix that represents the relation < must be set to ff. Thus, 
the idea is to store and incrementally maintain for each block C G P a list Rem(C) of blocks D G P such 
that: 

(A) If C is a relation refiner for T n then Rem(C) / 0; 

(B) If D G Rem(C) then necessarily D ^V£(C). 
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1 / / Precondition: BCount and preE are updated with the current PR 

2 updateCount (list(Block) split) { 

3 forall B g split do addNewEntry(B) in matrix Count; 

4 forall BePdo 

5 forall C € split do 

6 if (B. intersection = tt) then Count(B, C) : = Count (B. brother, C.brother); 

7 else Count(B, C) := Count(B, C.brother); 



i 
in 



forall C* e P do 

forall B £ sp/if do 
|^ if (C. intersection ; 



: ff) then Count(B, C) := Count (B. brother, C); 



12 
13 
14 
15 
16 
17 
18 

19 

20 
21 
22 
23 
24 
25 
26 

27 
28 
29 
30 

31 } 



forall CePdo unmark(C); 
forall B 6 split do 

// Update Count(B, ■) and Count(B. brother, ■) 
Block X, Z; 

if (B. size < B. brother. size) then 
| {X := B; Z : = B.brother;} 
else 

[_ {X := B.brother; Z := B;} 

forall CePdo {Count(X, C) := 0; /* Count(Z, C) := Count(B, C); */} 
forall x £ X do 

forall j/ £ post (x) do 

if unmarked(y. block) then 
mark(j/. block); 

forall C £ P such that C < j/.Moofe do 
Count(X,C)++; 

if (BCount(Z, y.block) = 0) then Count(Z.C) — ; 



// For all D {B, B.brother}, update Count(B, ■) 
forall D £ X.preE do 

if(B^X&B^Z & BCount(B, Z) = 1) then 
|_ forall C eP such that C«do Count(D, C)++; 



Figure 6: updateCount function. 



It turns out that C is a relation refiner for J" 11 iff there exist blocks B and D such that B-^C, D € Rem(C) 
and B < D. Hence, the set of blocks Rem(C) is reminiscent of the set of states remove(s) used in 
Henzinger et al.'s lfl5ll simulation algorithm, since each pair (B,D) which must be removed from the 
relation < is such that D € Rem(C), for some block C. 

Initially, namely at the first call of RStabilize by ESim, Rem{C) is set by the function Initialize in 
Figure|2]to {D € P | L>^ 3 S, L>^ 3 /xy(C)}. Hence, RStabilize scans all the blocks in the current partition 
P and selects those blocks such that Rem(C) ^ 0, which are therefore candidate to be relation refiners. 
Then, by scanning all the blocks B £ C.preE and D £ Rem(C), if B < D holds then the entry B < D 
must be set to ff. However, the removal of the pair (£>, D) from the current relation < may affect the 
function /ij>. This is avoided by making a copy oldRem(C) of all the i?em(C)'s at the beginning of 
RStabilize and then using this copy. During the main for-loop of RStabilize, Rem(C) must therefore 
satisfies the following invariant property: 

(Inv): VC £ P. Rem(C) = {D £ P \ D -^V> (C), £> ^ 3 /^(C)}. 

This means that at the beginning of RStabilize, any Rem(C) is set to empty, and after the removal of a pair 
(B, D) from <, since fJ,j>(B) changes, we need: (i) to update the matrix Count, for all the entries (F, B) 
where F-^D, and (ii) to check if there is some block F such that F -^^y(B), because any such F must 
be added to Rem(B) in order to maintain the invariant property (Inv). 
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1 bool RStabilizeQ { 

2 1 1 := M3>; 

3 forall CePdo {oldRem(C) := Rem(C); Rem(C) = 0; } 

4 bool Removed := ff; 

5 forall C e P such that oldRem(C) ^ do 

6 // Invariant (Inv): VC* 6 P. Rem(C) = {D <= P \ D -^ 3 ^(C), D -/ 3 ^y(C)} 

7 forall B 6 C.preE do 

8 forall £> G oldRem(C) do 

9 if (B < D) then 

10 B < D := ff; Removed := tt; 

11 / / update Count and Rem 

12 forall F 6 D.preE do 

13 Count(F, B) : = Count(F, B) - 1; 

14 if (Count(F, B) = 0) then 

is if (Rem(B) = 0) then // F^ 3 ^{B) & F ^^(B) 

16 J_ Rem(B). append(F); 



17 return ^Removed; 

18 } 



Figure 7: RStabilize Algorithm. 



5 Complexity 

The time complexity bound of the algorithm ESim relies on the following key properties: 

(1) The overall number of partition refiners found by ESim is bounded by |P s ; m | — \P(\ and therefore 
is in O ( | P s ; m | ) . Moreover, the overall number of newly generated blocks by the splitting operations 
performed by calling Split(S) at line 5 of PStabilize is in 0(|P s i m |). In fact, let {Pi}ie[o,n] be 
the sequence of different partitions computed by ESim where P is the initial partition Pi, P n is 
the final partition P s j m and for all i £ [1, n], Pi is the partition after the i-th call to Split(S), so 
that Pi ~< Pi-i- The number of newly generated blocks by a call Split(S) refines Pi to P i+ i is 
2(|Pj+i| — \Pi\). Thus, the overall number of newly generated blocks is J]" =:L 2(|Pi | — |Pi-i|) = 

2(|Psim| - \Pt\) eO(|Psim|). 

(2) The invariant (Inv) of the sets Rem(C) guarantees the following property: if C\ and C 2 are two 
blocks that are selected by the for-loop at line 5 of RStabilize in two different calls of RStabilize, 
and C 2 C Ci (possibly d = C 2 ) then (U Rem(Ci)) n (U Rem{C 2 )) = 0. 

Theorem 5.1. ESim runs in 0(\P s i m \ 2 log |P s i m | + |E| log \T,\)-space and 0(|P s i m | M log \T,\)-time. 

Proof. Space Complexity. The input transition system is represented by the post relation, so that the 
size of post is not taken into account in the space complexity of ESim. The doubly linked list of states 
take 0(|S| log |S|) while the pointers s.block take 0(|S| log P s i m |). The partition P and the pointers 
stored in eack block of P overall take 0(|P s i m | log |S|). The binary relation <J takes 0(|P s i m | 2 )- The 
auxiliary data structures Rem, preE and BCount overall take 0(|P s i m | 2 ), while the integer matrix Count 
takes O ( | P s i m | 2 log | P s - lm \ ) . Hence, the overall bit space complexity for storing the above data structures is 
0(|P sim | 2 log|P sim | + |E|log|S|). 

Time Complexity. The time complexity bound of ESim is shown by the following points. 

(A) The initialization function Initialize takes |P| 2 + + \P\\{(B,D) B,D e P, B^D}\ time. 
Observe that | P| < |P s i m | < | -> | so that the time complexity of Initialize is in 0(|P s i m ||^|). 

(B) A call to pre/x(C) takes 0(|->|) time. A call to Split(S) takes |5| time. Since S is returned by 
pre/x(C), \S\ < |^| holds so that the time complexity of a call to Split (S) is in 0(|->|). A call to 
Post(B) takes |{(6, c) | b G B, c e E, b^c}\ time, so that a call to FindPRefiner takes 0(|->|) time. 
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Moreover, let us observe that FindPRefiner returns null just once, because when FindPRefinerieturns 
null the current PR of ESim is both partition and relation stable and therefore ESim terminates and 
outputs that PR. Consequently, since, by point (1) above, the overall number of partition refiners is 
in 0(|P s im|), the overall number of function calls for FindPRefiner is in 0(|P s im|) and, in turn, the 
overall time complexity of FindPRefiner is in 0(|P s i m | |->|) time. Also, the overall time complexity 
of preju(C) and Split (S) is in 0(\P sim \\^\). 

(C) Let us observe that the calls updateRel(split) and updateRem(split) take 0(\P\\split\) time, while 
updatePreEQ and updateBCount(split) take 0(|-^|) time. Since the overall number of calls for these 
functions is in 0(\P s - lm \) and since ^Reiterations \ s P^i\ i s m 0(|P s ; m |), it turns out that their overall 
time complexity is in 0(|P sirn |(|P sinl | + |->|)), so that, since |P sim | < it is in 0(|P sim ||->|). 
Moreover, as already shown in Section [43] the overall time complexity of updateCount(split) is in 
0(|P sim |h|log|E|). 

(D) Hence, by points (B) and (C), the overall time complexity of P Stabilize is in 0(|P S im|M log |E|). 

(E) Let C G Pi n be some block of the initial partition and let (Ci)i e / C , for some set of indices Ic, be 
a sequence of blocks selected by the for-loop at line 5 of RStabilize such that: (a) for any i G Ic, 
Ci G C and (b) for any i, Cj+i has been selected after Ci and C^+i is contained in Ci. Observe 
that C is the parent block in p n of all the Cj's. Then, by the property (2) above, it turns out that the 
corresponding sets in {\JRem(Ci)}i^i c are pairwise disjoint so that J^iei I R em (Ci)\ — |Pim|- 
This property guarantees that if D G oldRem(Ci) at line 8 then for all the blocks D' G D and for 
any j G Ic such that i < j, D' g" oldRem(Cj). Moreover, if the test B < D at line 9 is true for 
some iteration k, so that B < D is set to ff, then for all the blocks D 1 and B' such that D 1 G D 
and B' G B the test D' < B' will be always false for all the iterations which follow k. From these 
observations, we derive that the overall time complexity of the code of the for-loop at lines 7-10 is 
EcE i£ z E B ^c \Rem(Ci)\ < \P sim \\{(B,C) | B,C e P sim ,B^C}\ < \P sim \h\- More- 
over, the overall time complexity of the code of the for-loop at lines 12-16 is J^b TId J2f^ 3 d 1 — 
|Pim||{(P, D) | F,D G P s i m ,F^ 3 D}\ < |P s im|H. We also observe that the overall time com- 
plexity of the for-loop at line 3 of RStabilize is in 0(|P s i m | 2 )- Thus, the overall time complexity of 
RStabilize is in 0(|P S i m |(|P S i m | + |^|)), so that, since |P S i, n | < it is in 0(|P s i m ||^|). 

Summing up, by points (A), (D) and (E), we have shown that the overall time complexity of ESim is in 

0(|Psim|h|log|S|). " ' □ 

6 Conclusion and Further Work 

We have introduced a new algorithm, called ESim, for efficiently computing the simulation preorder which: 
(i) reaches the space bound of the simulation algorithm GPP [ W\ fTTIl featuring the best space complexity, 
while significantly improving its time bound; (ii) significantly improves the space bound of the simulation 
algorithm RT |20, 21 ] featuring the best time complexity, while closely approching its time bound. More- 
over, the space complexity of ESim is quasi-optimal, meaning that it differs only for logarithmic factors 
from the size of the output. 

We see a couple of interesting avenues for further work. A first natural question arises: can the time 
complexity of ESim be further improved and reaches the time complexity of RT? This would require to 
eliminate the multiplicative factor log |S| from the time complexity of ESim and, at present, this seems 
quite hard to achieve. More in general, it would be interesting to investigate whether some lower space 
and time bounds can be stated for the simulation preorder problem. Secondly, ESim works for Rripke 
structures. While an adaptation of a simulation algorithm from Kripke structures to labeled transition 
systems (LTSs) can be conceptually simple, unfortunately such a shift may lead to some loss in both 
space and time complexities. We mention [ 1 , 16| and 1 18] that provide simulation algorithms for LTSs by 
adapting, respectively, RT and GPP. Thus, it is worth investigating how ESim can be efficiently adapted to 
work with LTSs. 
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